Privacy Policy.

How Hyperscale collects, uses, protects and shares personal data under the PDPL, organised around who you are to the platform.

The policy distinguishes visitors, tenant administrative users, and the end users of a tenant's product. It states when Hyperscale acts as controller or processor, which data it handles, and how to contact privacy@hyperscale0.ai.

Hyperscale is the foundation for what gets built next. A founder describes a company in one sentence, and Hyperscale builds its foundation on a licensed bank partner. The founder works in the portal with the Architect. Developers can use the CLI, Product API, generated SDKs, or MCP. Every state change records who asked, what ran, and the result in a receipt. Hyperscale is not a bank and never holds a tenant's money under its own name.

Every Product starts in a sandbox with test identities, provider simulators, and play money. No tenant is live today. The current systems connect to no real bank infrastructure. Moving a future Product to live use requires a separate Product Activation review, identity checks, provider approval, and billing readiness. The bank partner would perform every regulated money movement.

Effective 18 July 2026

This policy explains how Hyperscale LLC ("Hyperscale", "we", "us") collects, uses, protects, and shares personal data. Hyperscale provides financial infrastructure that businesses use to build and operate financial products in the Kingdom of Saudi Arabia. Because we sit underneath other companies' products, who we are to you depends on who you are to us. This policy starts there.

The current environments are test environments. No real bank infrastructure is connected. Hyperscale is not a bank or money handler.

We wrote this policy to be read. If anything is unclear, write to us at privacy@hyperscale0.ai.

1. Who you are, and who we are to you

This policy covers four kinds of people. Throughout the policy, these terms carry the meanings given here.

Visitors are people who browse this website, read our documentation, or contact us without holding an account. For Visitors, Hyperscale is the controller of your personal data: we decide why and how it is processed.

Customers are the businesses that sign an agreement with us and build on our platform. Administrative Users are the individual staff of a Customer who operate the Hyperscale dashboard: founders, finance teams, developers, compliance officers. For Customers and Administrative Users, Hyperscale is the controller of the data we need to run the relationship itself: account details, billing records, security logs, and dashboard activity.

End Users are the customers of our Customers: the people who hold the accounts, cards, and wallets that our Customers build on Hyperscale infrastructure. End Users are not Hyperscale's direct customers. When End User personal data transits or is stored on our platform, we act as a processor. We handle that data only on the documented instructions of the Customer whose product you use, under a data processing agreement with that Customer. The Customer, not Hyperscale, decides what is collected and why. If you are an End User and want to exercise your privacy rights, contact the company whose product you signed up for; Section 9 explains how we help route those requests.

One important exception. Financial infrastructure carries legal duties of its own. Where the law requires Hyperscale itself to process personal data, for customer due diligence, fraud prevention, or the record-keeping obligations placed on financial infrastructure providers, we process that data as an independent controller, on the legal basis of compliance with a legal obligation. In those specific situations we are not acting on a Customer's instructions, because the obligation is ours. Everything else in this policy about our processor role remains true outside that exception.

2. Information we collect

We collect personal data in four ways: directly from you, automatically when you use our website or platform, from our Customers when they submit End User data to the platform, and from verification sources when the law requires us to check who we are dealing with. Personal data we hold is stored on Hyperscale-managed, encrypted systems; Section 4 describes the protections in more detail.

From Visitors. When you browse this website we automatically collect limited technical data: IP address, browser type, pages viewed, and the session cookie described in Section 10. If you contact us, we collect what you send: your name, email address, company, and the content of your message.

From Customers and Administrative Users. When a business signs up, we collect, directly from the business and its staff, the information needed to open and operate the account: legal entity details, commercial registration information, contact details of Administrative Users, and billing information. As required by law, we also collect due diligence information about the business and its representatives, and we may supplement it with information from verification sources. While you use the dashboard, we automatically collect security and activity records: sign-in events, IP addresses, and the actions Administrative Users take. These records are kept in an append-only audit log, which means entries cannot be edited or deleted after the fact.

From End Users, via our Customers. We receive End User personal data from our Customers, not from End Users directly. What we receive depends entirely on the product the Customer has built; it may include names, identifiers, contact details, and transaction records. Every personal data field the platform can hold is declared in a single internal data registry, so we know at all times what categories of personal data exist on the platform, which are sensitive, and how each is protected. We do not collect End User data beyond what the Customer's product submits.

3. How we use personal data

We use personal data only for the purposes below, each resting on a legal basis recognized by the Saudi Personal Data Protection Law (PDPL) and, where it applies, the EU and UK GDPR.

To provide the services (performance of a contract). Operating accounts, executing the platform functions our Customers have configured, providing support, and billing. For End User data, we process on our Customers' instructions under the data processing agreement.

To meet our legal obligations (compliance with law). Customer due diligence, fraud prevention, responding to lawful requests from authorities, and keeping the records that financial infrastructure providers are required to keep. This is the processing described in the Section 1 exception, where we act as an independent controller.

To secure and improve the platform (legitimate interests). Monitoring for unauthorized access, investigating incidents, and understanding how the platform is used so we can make it better. We rely on legitimate interests narrowly: only where our interest is real and specific, where the processing would be within your reasonable expectations, and never for sensitive personal data. Where the PDPL requires consent, and always for sensitive or credit data, we process only with explicit consent; no other basis substitutes for it.

To send you marketing (consent). If you ask to hear from us about products or updates, we will write to you, and you can withdraw that consent at any time. We do not need consent to send service communications that the account relationship requires, such as security notices.

We do not use personal data for automated decisions that produce legal effects on individuals without human involvement, and we do not sell personal data. Ever.

4. How we protect personal data

Security is the foundation of what we sell, and the same controls protect personal data. The full picture is on our Security page; the parts most relevant to privacy are these.

Sensitive personal data fields are sealed with field-level AES-256-GCM envelope encryption, under keys maintained per Customer. That means one Customer's sensitive data is encrypted under keys that are useless for any other Customer's data. Access to data is tenant-isolated and enforced by row-level security in the database itself, not only in application code. Audit records are append-only.

When personal data is deleted, we delete it by cryptographic erasure: the encryption key for the subject is destroyed in the current database, which renders the encrypted values unreadable there. Earlier database copies that retain the wrapped subject key and its wrapping key can still decrypt those values. Cryptographic erasure affects the current database only, and we state this boundary here because the PDPL requires us to tell you how personal data is destroyed.

No system is perfectly secure, and we will never claim ours is. What we can say is that protection is built into how the platform stores data, not added around it.

If a breach of personal data occurs that may cause harm to you or to your data, we will notify the Saudi Data and Artificial Intelligence Authority within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay, describing what happened, what data was involved, what the consequences may be, and what we have done to contain it. Where another law such as the GDPR sets its own notification duty, we follow that duty for the data it covers.

5. When we share personal data

We do not sell or rent personal data, ever, to anyone. We share personal data only with the following categories of recipients, and only as far as each purpose requires.

Service providers. Companies that help us run the platform, listed in Section 6. Each is bound by contract to process personal data only on our instructions, only for the service they provide to us, and never for their own purposes.

Financial Partners. Banks and licensed financial institutions we work with where their involvement is required to provide the services, for example to hold funds or settle payments. We share only what the specific service requires.

Authorities, when legally compelled. Regulators, law enforcement, and courts, where the law requires us to disclose. We review every demand, disclose only what the demand lawfully covers, and, where the law allows, notify the affected Customer.

A successor, in a business transfer. If Hyperscale is involved in a merger, acquisition, or sale of assets, personal data may transfer to the successor entity. It would remain subject to this policy, and we would notify Customers before any materially different policy applied to their data.

6. Subprocessors

When we act as a processor for End User data, the third parties we engage to help process that data are our subprocessors. Our current subprocessors are:

Subprocessor Purpose Data involved
Third-party AI model provider AI-assisted product features Prompts and context supplied through the platform when those features are used
Cloudflare Network ingress, TLS termination, and transactional email delivery Network traffic metadata and email recipient addresses

We maintain and update this list on this page, and we notify Customers of material changes so they can raise objections under their data processing agreement before a change takes effect.

Infrastructure we operate ourselves, including our PostgreSQL databases and our ledger, is not a subprocessor: no third party processes that data on our behalf.

As identity verification features launch, we may engage data sources for identity verification, and we will update this list with notice before they process personal data.

7. International transfers

Hyperscale is built for Saudi Arabia. [Personal data is processed and stored in the Kingdom of Saudi Arabia by default: confirm residency posture with owner before publication.]

Where any personal data is transferred outside the Kingdom, we limit the transfer to the minimum necessary to fulfil the purpose, and we make it only as the PDPL and the Regulation on Personal Data Transfer Outside the Kingdom permit: to destinations covered by an adequacy decision, or under appropriate safeguards such as standard contractual clauses, binding common rules, or an approved certification, with risk assessments where the regulation requires them. The subprocessors listed in Section 6 may process limited data outside Saudi Arabia in the course of providing their services; those transfers are governed by contractual safeguards with each subprocessor.

Data connected with a Financial Partner arrangement may carry additional location and handling requirements under SAMA's rules for outsourcing and cloud computing, which give priority to keeping data in Saudi Arabia. Where those rules apply, they control.

For personal data subject to the EU or UK GDPR, transfers are made under recognized transfer mechanisms such as adequacy decisions or standard contractual clauses.

8. How long we keep personal data

We keep personal data only as long as a purpose in Section 3 requires, and we determine retention by criteria rather than a single fixed period.

For Customers and Administrative Users, we keep account data for the life of the relationship, and afterwards for as long as the statutory record-keeping periods that apply to financial infrastructure require. The Saudi Anti-Money Laundering Law requires transaction records and due diligence files to be kept for at least ten years after a transaction completes or a relationship ends, and where a period like that applies, it controls.

For End User data, retention is set by our Customers' instructions within the limits of the law, with one platform-wide rule: when an end-customer record is disabled, it is automatically erased 365 days later by cryptographic erasure, unless a legal obligation requires us to keep it longer.

When no purpose or legal obligation remains, we destroy personal data by cryptographic erasure, as described in Section 4.

9. Your rights

Your rights depend on which law applies to you. Because Hyperscale is a Saudi platform, we start with the PDPL.

Under the PDPL, you have the right to:

We respond to rights requests within 30 days. Where a request is complex or requests are numerous, the law permits us to extend that period by a further 30 days, and if we do, we will tell you why. If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA), the competent authority for data protection in the Kingdom.

Under the EU or UK GDPR, if it applies to you, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, as well as the right to withdraw consent at any time without affecting prior processing, and the right to complain to a supervisory authority in your country.

How to exercise your rights. Write to privacy@hyperscale0.ai. We will ask you to verify your identity before we act on a request, because releasing personal data to the wrong person is itself a breach. The platform's data-export capability lets us honour access and portability requests in a machine-readable format.

If you are an End User, the company whose product you use controls your data, and your request belongs with them. Contact the provider you signed up with. If you contact us instead, we will not ignore you: we will route your request to the Customer you interacted with and support them in responding.

10. Cookies

This website uses strictly necessary cookies only: session cookies that keep you signed in to authenticated areas. They are essential to the service, so they do not require consent, and they expire with your session.

We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. [If analytics cookies are added later, expand this section and add a consent mechanism before launch.]

11. Children

Hyperscale provides services to businesses. Our website and platform are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@hyperscale0.ai and we will delete it.

12. Changes to this policy

When we change this policy, we will post the updated version on this page with a new effective date. For material changes, we will notify Customers directly, with enough notice to review the change before it takes effect. The version on this page is always the current one.

13. Contact

Questions, requests, and complaints about privacy all start in the same place:

Email: privacy@hyperscale0.ai
Post: Hyperscale LLC, King Salman Neighborhood, Riyadh, Saudi Arabia

If we cannot resolve your concern, you may complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) in the Kingdom of Saudi Arabia or, for GDPR matters, to your local supervisory authority.

This Policy is written in English. Where Hyperscale publishes an Arabic version of this Policy, the Arabic version prevails to the extent of any conflict between the two versions.